Update organization execution policy

Reviewed source-contract reference. CLI 0.13.4 is released. Hosted pack contracts below are taken from Agent source 573c9a11b1b6674b163ce21273a162a4ed453282; their activation and deployed worked responses remain pending. This draft does not establish settings, shared context or intake acceptance for the existing 70 Codex and 70 Claude agents.

Outcome

Organization-owned restrictive execution ceiling; separate from installation consent, immutable packs and native enforcement.

PUT /api/organization-execution-policy

Before calling

Discover the exact credential-scoped published action and intended context. Use an active, remotely verified human identity in the organization whose policy will change. The verified principal must have role owner or admin in that same organization and an explicit app_topolo_agent.organization_execution_policy:write or agent.organization_execution_policy:write grant. Auth must resolve an active Agent workspace in the same organization and app with admin access; an omitted workspace header causes default-workspace resolution, not a waiver. A supplied header is only a claim until Auth verifies it. Platform roles, wildcard scopes, agents:write, service credentials and resource-bound API keys do not supply this authority. Discover the credential-scoped published contract, plan the complete policy using the current expected revision and genuine decision reference, and confirm the unchanged authorized mutation. Verified minimumAccess and workspace accessLevel must both be admin. Plan and confirm the unchanged mutation; this draft does not authorize it.

Input fields

Source input template

The following schema-based example is illustrative and has not been executed. Every fixture identifier/decision reference must be replaced with a genuinely discovered resource or recorded decision. Do not send it unchanged.

{
  "expectedRevision": "0",
  "policy": {
    "allowedProfiles": [
      "manual"
    ],
    "maximumProfile": "manual",
    "defaultProfile": "manual",
    "fullAccessEnabled": false,
    "allowedToolScopes": [],
    "allowedActionScopes": [],
    "allowedIntakes": [],
    "scopePolicyMode": "allowlist"
  },
  "decisionReference": "fixture-reviewed-decision-reference"
}

Interpret and verify

• Read organization_execution_policy.get; compare the actual committed revision, canonical digest and body before native activation.
• Policy persistence does not prove native enforcement. Native adapters must refuse allowlist activation, including empty deny, until filtering is enforceable. Explicit 1.1 unrestricted mode requests no tool/action narrowing and requires both scope lists empty; intake/profile ceilings, existing consent/native acknowledgement and server RBAC/OAuth remain independent.

The exact input and output schemas accompany this draft in the hidden agent layer and contract bundle. No successful/refused deployed response is supplied here; capture and validate it after the original activation/usage proof.

Effects

• Replaces only the authenticated organization execution ceiling after confirmed administrator authorization and revision compare-and-swap.

Errors and recovery

• 400 invalid_policy_input: Use the closed schema. Profiles must respect ceiling/default/full opt-in; 1.1 scopePolicyMode must be allowlist or unrestricted, unrestricted requires empty tool/action lists; lists are unique exact names with no wildcards. Intake keys are pack/intakes/agent safe lowercase ids.
• 403 workspace_admin_context_required: Select the already authorized active Agent workspace in the same organization and application, then verify minimumAccess admin and accessLevel admin. Do not upgrade roles, change grants or bypass this prerequisite to retry.
• 403 organization_policy_admin_permission_required: Same-org admin plus an explicit Agent policy-write grant is required; platform role/wildcard/agents:write do not grant this capability.
• 403 organization_policy_management_key_not_supported: Resource-bound API keys never receive workspace-admin authority. Use the approved interactive administrative identity.
• 409 policy_revision_conflict: Read current policy and review changes. A stale revision writes nothing.
• 409 policy_revision_overflow: Revision must remain below the safe integer ceiling; stop and route ownership review.
• 503 policy_write_outcome_uncertain: Reconcile by GET; never retry an uncertain write blindly.

On uncertain response, GET and compare expected new revision/digest before deciding any further write. On conflict, review current policy; never blindly replay or restore a wider ceiling.

The source contract classifies recovery as manual: reconcile by GET, then review and separately authorize any new corrective CAS update.